我試圖在 Spring Security 的失敗登錄響應中添加更多信息。這是我的配置：@EnableWebSecurity@EnableGlobalMethodSecurity(prePostEnabled = true)public class SecurityConfig extends WebSecurityConfigurerAdapter { private final CustomAuthenticationProvider authProvider; private final CustomAuthEntryPoint customAuthEntryPoint; public SecurityConfig(CustomAuthenticationProvider authProvider, CustomAuthEntryPoint customAuthEntryPoint) { this.authProvider = authProvider; this.customAuthEntryPoint = customAuthEntryPoint; } @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.authenticationProvider(authProvider); } @Override protected void configure(HttpSecurity http) throws Exception { http .cors().and() .logout().deleteCookies("SESSION").and() .authorizeRequests() .antMatchers("/actuator/**").permitAll() .anyRequest().authenticated().and() .httpBasic().authenticationEntryPoint(customAuthEntryPoint).and() .csrf().disable(); }}@Componentpublic class CustomAuthEntryPoint implements AuthenticationEntryPoint { @Override public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException { System.out.println("entrypoint " + exception.getClass().getName()); response.getOutputStream().print(exception.getClass().getName()); response.sendError(401, exception.getClass().getName()); }}當我嘗試登錄時，它第一次進入自定義入口點，并出現良好的異常（BadCredentialsException），但接下來我認為 Spring 會嘗試請求/error，然后它會返回到入口點InsufficientAuthenticationException（來自ExceptionTranslationFilter.sendStartAuthentication）。在響應中，我有一個 401，沒有任何正文，甚至沒有入口點中定義的異常類名。知道配置有什么問題嗎？
1 回答
慕運維8079593
TA貢獻1876條經驗 獲得超5個贊
你是對的，spring嘗試重定向到“/error”，因為你在CustomAuthEntryPoint中調用了response.sendError并嘗試再次進行身份驗證，因此你得到另一個InsufficentAuthentication異常。解決此問題的一種方法是使用response.setStatus(401)而不是response.sendError方法。就像這樣：
@Component
public class CustomAuthEntryPoint implements AuthenticationEntryPoint {
@Override
public void commence(HttpServletRequest request, HttpServletResponse response,
AuthenticationException exception) throws IOException, ServletException {
System.out.println("entrypoint " + exception.getClass().getName());
response.getOutputStream().print(exception.getClass().getName());
response.setStatus(401);
}
}
或者，您可以從授權中排除“/error”url，但您必須小心不要泄漏該錯誤端點上的敏感信息：
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.cors().and()
.logout().deleteCookies("SESSION").and()
.authorizeRequests()
.antMatchers("/actuator/**","/error").permitAll()
.anyRequest().authenticated().and()
.httpBasic().authenticationEntryPoint(customAuthEntryPoint).and()
.csrf().disable();
}
添加回答
舉報
0/150
提交
取消